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DETAILED ACTION 

Claim Rejections - 35 USC § 101 

1 . Claims 31 and 32 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. 

Claims 31 and 32 lack the proper preamble necessary for a statuary computer 
program product claim. See MPEP 2100 for guidance on computer related inventions. 
The examiner suggests a preamble as follows: 

"31 . (Original) A computer readable medium containing computer executable 
instructions, when performed in a transceiver having a coupling to a communications 
interface provides a method for authenticating the transceiver with a control station in a 
network by performing the operations of:" 

"32. (Original) A computer readable medium containing computer executable 
instructions, when performed in a control station having a coupling to a communications 
interface provides a method for authenticating a transceiver with the control station by 
performing the operations of:" 

Claim Rejections - 35 USC § 103 

2. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 
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(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

3. Claims 1-9,11,1 3-20, 22-24, 26, 28-32, 34 and 40-53 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Leivo et al (US 6,782,080) in view of Reader 
(US 2004/0054905A1) and further in view of Hughes et al (US 6,842,106). 

Regarding claims 1 , 13, 31 and 32, Leivo teaches a method for authenticating 
operation of a transceiver with a control station within a wireless remote identification 
system (see Abstract and Title, see "authenticating" and see fig. 3, item 33), the method 
comprising: receiving transceiver configuration information including a network address 
(see column 7, lines 6-25, see "code") and transceiver authentication credentials (see 
column 7, lines 6-25, see "code"), receiving an authentication request from a control 
station within the remote identification system (see column 7, lines 6-25, see "request" 
or "requested"), and transmitting the authentication response to the control station to 
allow the control station to determine if the transceiver is authorized to communicate 
within the remote identification system (see column 7, lines 6-25, see "response"). 

Leivo does not specifically disclose applying authentication processing to request 
information within the authentication request in conjunction with the transceiver 
authentication credentials to produce an authentication response. 

Reader teaches applying authentication processing to request information within 
the authentication request in conjunction with the transceiver authentication credentials 
to produce an authentication response (see pages 4-5, [0038]). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Reader into the system of Leivo 
in order to protect member privacy (see Reader, [0003]). 

The combination of Leivo and Reader does not specifically disclose producing an 
authentication response for authenticating the transceiver by applying authentication in 
the authentication processing to request information, the authentication processing 
being based on use of the authentication credentials associated with transceiver. 

Hughes teaches producing an authentication response for authenticating the 
transceiver by applying authentication in the authentication processing to request 
information (see Abstract, column 6, lines 12-18 and column 7, lines 32-47), the 
authentication processing being based on use of the authentication credentials 
associated with transceiver (see column 4, line 66 to column 5, line 10 and column 5, 
lines 19-30). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Hughes into the system of Leivo 
and Reader in order to provide a method for secure communications between a RFID 
and RFID tags (see Hughes, column 1 , lines 6-10). 

Regarding claims 2 and 17, Leivo further teaches i) a transceiver identification 
code uniquely assigned to the transceiver (see column 8, lines 32-47, see "code"), and 

ii) a transceiver instruction set containing a set of authentication values and 
corresponding authentication instructions (see column 7, lines 6-25). 
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Regarding claims 3, 18 and 45, Leivo further teaches periodically receiving 
replacement transceiver authentication credentials to replace the transceiver 
authentication credentials formerly received by the transceiver (see column 7, lines 6- 
25). 

Regarding claims 4, 19, 42 and 46, Leivo further teaches the request information 
within the authentication request includes: i) an request authentication result (see 
column 7, lines 6-25), and ii) a request data value (see column 7, lines 6-25, see 
"request"), wherein applying authentication processing to request information within the 
authentication request in conjunction with the transceiver authentication credentials to 
produce an authentication response (see column 7, lines 6-25, see "code") comprises: 
identifying an authentication instruction that matches the request authentication result 
(see column 7, lines 25-54), and applying the authentication instruction that matches the 
request authentication result to the request data value from the authentication request 
to produce the authentication response (see column 7, lines 25-54). 

Regarding claims 5, 20, 43 and 47, Leivo further teaches applying an 
authentication function to authentication values in the set of authentication values within 
the transceiver authentication credentials to produce corresponding transceiver 
authentication results (see column 7, lines 6-25), and for each transceiver 
authentication result produced, determining if the transceiver authentication result 
matches the request authentication result for that authentication value (see column 7, 
lines 6-25), and if the transceiver authentication result matches the request 
authentication result for that authentication value (see column 7, lines 6-25), performing 
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the operation applying the authentication instruction to produce the authentication 
response (see column 7, lines 6-25). 

Regarding claims 7, 22 and 48, Leivo further teaches applying the authentication 
instruction to the request data value in conjunction with the transceiver identification 
code to obtain the authentication response (see column 7, lines 6-25 and see column 8, 
lines 32-48). 

Regarding claims 8 and 23, Leivo further teaches i) an authentication 
acknowledgement is received from the control station indicating that the transceiver was 
successfully authenticated (see column 7, lines 6-25), and ii) a number of repeated 
attempts to authenticate the transceiver each fail (see column 7, lines 6-25). 

Regarding claims 9 and 24, Leivo further teaches i) a different request 
authentication result for use by the transceiver to select an authentication instruction 
(see column 8, lines 32-48), and ii) a different request data value for use by the 
transceiver during application of the selected authentication instruction (see column 8, 
lines 32-48). 

Regarding claims 1 1 and 26, Leivo further teaches performing an automatic 
download operation to receive the transceiver authentication credentials during trusted 
time period of operation of the transceiver (see column 8, lines 32-48). 

Regarding claims 14 and 29, Leivo selecting a transceiver authentication value 
from the transceiver authentication credentials (see column 7, lines 25-53 and column 
8, lines 32-48), and applying an authentication function to the transceiver authentication 
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value to produce the request authentication result for use in the authentication request 
(see column 8, lines 32-48). 

Regarding claims 15 and 30, Leivo further teaches applying an authentication 
instruction corresponding to the selected transceiver authentication value to the request 
data value in conjunction with a transceiver identification code of the transceiver to 
which the authentication request was provided in order to produce a control station 
response (see column 8, lines 32-48), and comparing the control station response to the 
authentication response answer within the authentication response to determine if they 
are equivalent, and if they are equivalent, indicating that the authentication response 
answer is valid (see column 8, lines 32-48). 

Regarding claims 16, 28, 41 and 50, Leivo teaches a transceiver comprising: a 
memory (see column 3, lines 52-67, see "database"), a communications interface (see 
fig. 3, connection between devices), an interconnection mechanism coupling the 
memory (see column 3, lines 52-67, see "database"), the processor (see column 5, lines 
12-13, see "processing"), and the communications interface (see fig. 3, connection 
between devices), the memory encoded with an authentication process that when 
executed by the processor (see Abstract and Title, see "authenticating"), causes the 
transceiver authenticate operation of the transceiver with a control station within a 
wireless remote identification system by causing the transceiver to perform the 
operations of: receiving, via the communications interface, transceiver configuration 
information including a network address and transceiver authentication credentials (see 
column 7, lines 6-25, see "code" and see column 8, lines 32-48), receiving, via the 
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communications interface, an authentication request from a control station within the 
remote identification system (see column 7, lines 6-25, see "request" or "requested"), 
and transmitting, via the communications interface, the authentication response to the 
control station to allow the control station to determine if the transceiver is authorized to 
communicate within the remote identification system (see column 7, lines 6-25, see 
"response"). 

Leivo does not specifically disclose applying authentication processing to request 
information within the authentication request in conjunction with the transceiver 
authentication credentials to produce an authentication response. 

Reader teaches applying authentication processing to request information within 
the authentication request in conjunction with the transceiver authentication credentials 
to produce an authentication response (see pages 4-5, [0038]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Reader into the system of Leivo 
in order to protect member privacy (see Reader, [0003]). 

The combination of Leivo and Reader does not specifically disclose applying 
authentication processing to request information within the authentication request by 
modifying the request information using the transceiver authentication credentials, 
producing an authentication response to include the modified request information. 

Hughes teaches applying authentication processing to request information within 
the authentication request by modifying the request information using the transceiver 
authentication credentials (see Abstract, column 6, lines 12-18 and column 7, lines 32- 
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47), producing an authentication response to include the modified request information 
(see column 3, lines 9-54 and column 7, lines 15-23). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Hughes into the system of Leivo 
and Reader in order to provide a method for secure communications between a RFID 
and RFID tags (see Hughes, column 1 , lines 6-10). 

Regarding claims 34 and 44, Leivo further teaches maintaining a set of 
authentication instructions and corresponding authentication values generated by the 
transceiver, matching an authentication value received in the authentication request 
from the control station to a respective corresponding authentication value in the set 
(see column 7 lines 25-53 and see column 8, lines 32-48), identifying a corresponding 
authentication instruction associated with the corresponding authentication value in the 
set and applying the corresponding authentication instruction to a data value in the 
authentication request to produce the authentication response (see column 7 lines 25- 
53). 

Regarding claims 40 and 49, Leivo further teaches applying authentication 
processing to request information within the authentication request in conjunction with 
the transceiver authentication credentials to produce an authentication response 
includes: based on information in the authentication request (see column 7, lines 6-25, 
see "request" or "requested"), identifying one of multiple authentication instructions 
maintained at the transceiver, and applying the identified one of multiple authentication 
instructions to i) a data value in the authentication request received from the control 
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station and ii) an identification code associated with the transceiver to produce the 
authentication response (see column 7, lines 6-25, see "response"). 

Regarding claim 51 , Leivo further teaches receiving the authentication request 
includes receiving a data value associated with the authentication request (see column 
7 lines 25-53 and see column 8, lines 32-48), and wherein producing the authentication 
response includes: selecting a given computational instruction of multiple computational 
instructions associated with the transceiver (see column 7, lines 6-25), computing an 
authentication response value by applying the given computational instruction to the 
data value associated with the authentication request (see column 7 lines 25-53 and 
see column 8, lines 32-48), and generating the authentication response to include the 
authentication response value (see Abstract). 

Regarding claim 52, Leivo further teaches receiving the authentication request 
includes receiving a first data value and a second data value from the control station 
(see column 8, lines 32-48), and wherein producing the authentication response 
includes: utilizing the first data value to identify an instruction of multiple instructions 
associated with the transceiver (see column 7, lines 6-25), computing an authentication 
response value by applying the identified instruction to the second data value, and 
generating the authentication response to include the authentication response value 
(see Abstract). 

Regarding claim 53, Leivo further teaches receiving a set of authentication 
values and corresponding instructions (see Abstract and Title, see "authenticating" and 
see fig. 3, item 33), applying a hash function associated with the transceiver to each of 
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the authentication values in the set to create a mapping of hashed authentication values 
to the corresponding instructions (see Abstract and Title, see "authenticating" and see 
fig. 3, item 33), wherein receiving the authentication request includes receiving a first 
data value and a second data value from the control station (see column 8, lines 32-48), 
and wherein producing the authentication response includes: comparing the first data 
value to the hashed authentication values in the mapping to identify a given instruction 
of multiple instructions associated with the transceiver (see column 7, lines 6-25), 
computing an authentication response value by applying the given instruction to the 
second data value (see Abstract and Title, see "authenticating" and see fig. 3, item 33), 
and generating the authentication response to include the authentication response 
value (see column 7, lines 6-25). 

4. Claims 6 and 21 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Leivo et al (US 6,782,080) in view of Reader (US 2004/0054905A1 ) and further in view 
of Hughes et al (US 6,842,1 06) and Phillips et al (US 6,721 ,555). 

Regarding claims 6 and 21 , the combination of Leivo, Reader and Hughes 
teaches claim 5. The combination of Leivo, Reader and Hughes does not specifically 
disclose the request authentication result is a hash value result produced from a hash 
function within the control station and wherein the authentication function is an 
equivalent hash function within the transceiver and wherein the request authentication 
result is calculated by the control station using the hash function on a copy of the 
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authentication values in the set of authentication values within the transceiver 
authentication credentials that is programmed into the control station. 

Phillips teaches the request authentication result is a hash value result produced 
from a hash function within the control station and wherein the authentication function is 
an equivalent hash function within the transceiver and wherein the request 
authentication result is calculated by the control station using the hash function on a 
copy of the authentication values in the set of authentication values within the 
transceiver authentication credentials that is programmed into the control station (see 
Title and column 6, lines 5-28). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Phillips into the system of Leivo, 
Reader and Hughes in order to provide a system for efficiently accommodating an 
authentication protocol in a communication network (see Phillips, Abstract). 

5. Claims 10 and 25 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Leivo et al (US 6,782,080) in view of Reader (US 2004/0054905A1 ) and further in 
view of Hughes et al (US 6,842,106) and Bolle et al (US 6,819,219). 

Regarding claims 10 and 25, the combination of Leivo, Reader and Hughes 
teaches claim 1 . The combination of Leivo, Reader and Hughes does not specifically 
disclose the transceiver is an RFID transceiver and wherein the control station operates 
an RFID management application. 
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Bolle teaches the transceiver is an RFID transceiver and wherein the control 
station operates an RFID management application (see column 5, line 61 to column 6, 
line 4). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Bolle into the system of Leivo, 
Reader and Hughes in order to provide a system for efficiently accommodating an 
authentication protocol in a communication network (see Phillips, Abstract). 

6. Claims 33 and 35 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Leivo et al (US 6,782,080) in view of Reader (US 2004/0054905A1 ) and further in 
view of Hughes et al (US 6,842,1 06) and Boylan et al (US 2005/01 66091 A1 ). 

Regarding claim 33, the combination of Leivo, Reader and Hughes teaches the 
transceiver authentication credentials (see Leivo, column 7, lines 6-25). The 
combination of Leivo, Reader and Hughes does not specifically disclose the transceiver 
authentication credentials includes at least one of a roll forward and a roll back 
instruction and wherein a request data value in the authentication request from the 
control station indicates an amount by which to roll an instruction set associated with the 
transceiver. 

Boylan teaches the transceiver authentication credentials includes at least one of 
a roll forward and a roll back instruction and wherein a request data value in the 
authentication request from the control station indicates an amount by which to roll an 
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instruction set associated with the transceiver (see page 5, claim 12 and see page 3, 
[0067]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Boylan into the system of Leivo, 
Reader and Hughes in order to provide a system to meet the demands of customers 
and hosting organizations for rapid change of business entities and real time 
performance (see Boylan, page 1, [0008]). 

Regarding claim 35, the combination of Leivo, Reader and Hughes teaches 
maintaining a set of authentication instructions and corresponding authentication values 
generated by the transceiver (see Leivo, Abstract and column 7, lines 6-25). The 
combination of Leivo, Reader and Hughes does not specifically disclose and shifting a 
relationship position of the authentication instructions relative to the corresponding 
authentication values in the set by an amount specified by a data value in the 
authentication request such that, after shifting the relationship position, each 
corresponding authentication value in the set corresponds to a different authentication 
instruction than prior to shifting the relationship position of the authentication instruction. 

Boylan teaches shifting a relationship position of the authentication instructions 
relative to the corresponding authentication values in the set by an amount specified by 
a data value in the authentication request such that, after shifting the relationship 
position, each corresponding authentication value in the set corresponds to a different 
authentication instruction than prior to shifting the relationship position of the 
authentication instruction (see page 5, claim 12 and see page 3, [0067]). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Boylan into the system of Leivo, 
Reader and Hughes in order to provide a system to meet the demands of customers 
and hosting organizations for rapid change of business entities and real time 
performance (see Boylan, page 1, [0008]). 

7. Claims 36-39 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Leivo et al (US 6,782,080) in view of Reader (US 2004/0054905A1 ) and further in view 
of Hughes et al (US 6,842,1 06) and Carroll et al (US 6,61 1 ,91 3). 

Regarding claim 36, the combination of Leivo, Reader and Hughes teaches the 
transceiver authentication credentials (see Leivo, Abstract and column 7, lines 6-25). 
The combination of Leivo, Reader and Hughes does not specifically disclose receiving a 
first alphanumeric value and a corresponding first instruction, receiving a second 
alphanumeric value and a corresponding second instruction, and maintaining the first 
alphanumeric value and the corresponding first instruction at the transceiver as a first 
value-instruction pair, maintaining the second alphanumeric value and the 
corresponding second instruction at the transceiver as a second value-instruction pair. 

Carroll teachers receiving a first alphanumeric value and a corresponding first 
instruction, receiving a second alphanumeric value and a corresponding second 
instruction, and maintaining the first alphanumeric value and the corresponding first 
instruction at the transceiver as a first value-instruction pair, maintaining the second 
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alphanumeric value and the corresponding second instruction at the transceiver as a 
second value-instruction pair (see column 14, lines 29-36). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Carroll into the system of Leivo, 
Reader and Hughes in order to provide an embedded private-key algorithm to ensure 
proper authentication key transfer (see Carroll, Abstract). 

Regarding claim 37, the combination of Leivo, Reader and Hughes teaches the 
transceiver authentication credentials (see Leivo, Abstract and column 7, lines 6-25). 
the combination of Leivo, Reader and Hughes does not specifically applying the 
authentication processing at the transceiver to the first alphanumeric value to generate 
a first transceiver generated result associated with the first alphanumeric value and the 
corresponding first instruction, applying the authentication processing at the transceiver 
to the second alphanumeric value to generate a second transceiver generated result 
associated with the second alphanumeric value and the corresponding second 
instruction, maintaining the first transceiver generated result along with the first value- 
instruction pair, and maintaining the second transceiver generated result along with the 
second value-instruction pair. 

Carroll teachers applying the authentication processing at the transceiver to the 
first alphanumeric value to generate a first transceiver generated result associated with 
the first alphanumeric value and the corresponding first instruction, applying the 
authentication processing at the transceiver to the second alphanumeric value to 
generate a second transceiver generated result associated with the second 
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alphanumeric value and the corresponding second instruction, maintaining the first 
transceiver generated result along with the first value-instruction pair, and maintaining 
the second transceiver generated result along with the second value-instruction pair 
(see column 14, lines 29-36). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to provide the teaching of Carroll into the system of Leivo, 
Reader and Hughes in order to provide an embedded private-key algorithm to ensure 
proper authentication key transfer (see Carroll, Abstract). 

Regarding claim 38, Leivo further teaches identifying an authentication value in 
the authentication request received from the control station, matching the authentication 
value in the authentication request to one of the first transceiver generated result and 
the second transceiver generated result (see Abstract and column 7, lines 6-25), and if 
the authentication value in the authentication request received from the control station 
matches the first transceiver generated result, utilizing the corresponding first instruction 
to generate a response to the control station (see Abstract and column 7, lines 6-25 and 
see column 8, lines 32-48), and if the authentication value in the authentication request 
received from the control station matches the second transceiver generated result, 
utilizing the corresponding second instruction to generate a response to the control 
station (see Abstract and column 7, lines 6-25). 

Regarding claim 39, Leivo further teaches identifying an authentication value in 
the authentication request received from the control station (see Abstract and column 7, 
lines 6-25), attempting to match the authentication value in the authentication request to 
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one of the first transceiver generated result and the second transceiver generated result 
(see column 7, lines 6-25 and column 8, lines 32-48), and if the authentication value in 
the authentication request received from the control station does not match either of the 
first and second transceiver generated result (see Abstract and column 7, lines 6-25), 
failing authentication of the transceiver (see Abstract, column 7, lines 6-25 and column 
8, lines 32-48). 

Allowable Subject Matter 

8. Claims 12 and 27 are objected to as being dependent upon a rejected base 
claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 

Claims 12 and 27 are objected for the reasons as stated in the previous Office 
action, page 9 (dated 11/02/05). 

Response to Arguments 

9. Applicant's arguments with respect to claims 1-11,1 3-26 and 28-53 have been 
considered but are moot in view of the new ground(s) of rejection. 

On page 28 of applicant's remarks, applicant argues that none of the cited 
references teaches or suggests "producing an authentication response for 
authenticating the transceiver by applying authentication processing to request 
information in the authentication request, the authentication processing being based on 
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use of the transceiver authentication credentials associated with the transceiver" as 
recited by the claimed invention. 

In response, the combination of Leivo, Reader and Hughes does indeed teach 
the newly added limitations as recited by the claimed invention. In addition, applicant's 
attention is directed to the teaching of Leivo, Reader and Hughes above. 



Conclusion 

1 0. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to NGHI H. LY whose telephone number is (571 )272-791 1 . 
The examiner can normally be reached on 9:30am-8:00pm Monday-Thursday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Dwayne Bost can be reached on (571) 272-7023. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
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USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Nghi H. Ly 



/Nghi H. Ly/ 

Primary Examiner, Art Unit 2617 



